This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [jiff](https://redirect.github.com/BurntSushi/jiff) |
workspace.dependencies | patch | `0.2.22` → `0.2.23` |
---
### Release Notes
<details>
<summary>BurntSushi/jiff (jiff)</summary>
###
[`v0.2.23`](https://redirect.github.com/BurntSushi/jiff/blob/HEAD/CHANGELOG.md#0223-2026-03-03)
[Compare
Source](https://redirect.github.com/BurntSushi/jiff/compare/0.2.22...0.2.23)
\===================
This release updates Jiff's bundled copy of the \[IANA Time Zone
Database]
to `2026a`. See the [`2026a` release announcement] for more details.
[`2026a` release announcement]:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
These are not managed by Renovate.
I wrote a script to do this, which I may commit separately. I used an
LLM to review each changelog for relevant changes as well as each diff
for malicious content.
## Summary
This is a non-behavior-changing refactor that puts direct source
information on individual `PubGrubDependency` edges. The resulting code
is, in my opinion, a bit simpler with clearer abstractions and more
consistent handling.
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:
- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->
## Summary
In [pep 639](https://peps.python.org/pep-0639/) the classifier for
licenses gets deprecated in favor of the license field.
The benefits for UV:
- Clear that you can pick a license, not have to have both
- Clear it is version 2 for the Apache license
https://peps.python.org/pep-0639/
## Test Plan
Builds, works.
If the license shows up in pypi.org with the SPDX operator, it works
## Summary
The affected code was manually implementing part of the full logic which
was already available in `settings::resolve_preview` so this PR just
makes the project validation code use this function instead.
## Test Plan
Existing test coverage.
## Summary
We need to normalize any relative managed-Python install roots before
checking whether the active environment’s interpreter is uv-managed, so
that `sync --active` reuses the environment.
Closes https://github.com/astral-sh/uv/issues/16631.
## Summary
The issue here is that once conflicts are introduced, the markers in the
lockfile get too complicated for our basic environment checks. We should
_also_ filter by supported environments here.
Closes https://github.com/astral-sh/uv/issues/18428.
## Summary
Attempt to track and preserve relative/absolute paths when read from files.
File URLs are treated as absolute. Synthetic VerbatimUrls shouldn't have
a `given`, and are treated as relative.
This means that paths passed as absolute will be output as absolute,
although they may get normalized. Paths passed as relative will be
output as relative but they may be relative to a different location (so
that they continue to work going forwards). Previously in various places
we'd either make things absolute unconditionally or relative
unconditionally.
Cases which should now be fixed:
- uv.lock - Path dependencies, indexes, and find-links were always
converted to relative paths.
- pylock.toml export (from_resolution path) - Paths were always
relativized. Now preserves the user's original format.
- pylock.toml export (from_lock path) - Relative paths from the lock
file were being converted to absolute paths. Now uses the path exactly
as stored in the lock file.
Also noteworthy is the bugfix for a windows misbehaviour. See the commit
message for some more information.
Note: For now the `uv add` side of this has been split off as a breaking change.
## Test Plan
Added missing tests, updated existing.
I believe all the changed tests are all now correct and were previously
demonstrating buggy behaviour. Well, at least if you are on board with
the idea that we should keep relative paths relative and absolute paths
and / file URLs absolute.
## Related Issues/PRs
* Closes https://github.com/astral-sh/uv/issues/15055
* Closes https://github.com/astral-sh/uv/issues/16602
* Closes https://github.com/astral-sh/uv/issues/16514
* Closes https://github.com/astral-sh/uv/pull/15870
## Summary
Once `uv audit` lands, this will be pretty confusing to users IMO.
I've changed it to "Checked" to demo-run the changes, but I'd definitely
appreciate opinions on a better term for this (scanned? validated?)
## Test Plan
Bumped so many snapshots.
---------
Signed-off-by: William Woodruff <william@astral.sh>
## Summary
This makes two changes to our handling of trove classifiers in uv's
build backend:
1. We now reject malformed trove classifiers. I've done this by adding a
`Classifier` newtype that parses and rejects anything that _looks_ wrong
(there's no formal grammar for classifiers, so this is a pretty
primitive check, but it should be enough to preempt most common user
errors). We don't use an allowlist at the moment, although in principle
we could do that as well/instead.
2. We now emit a user warning on any license classifiers, since these
have been deprecated since PEP 639 was accepted. I've added this within
`PyProjectToml::license_metadata` since in the future we'll also want to
produce a hard error when license classifiers are present _and_
new-style structured license metadata is also present. That change will
require a breaking release however.
Closes https://github.com/astral-sh/uv/issues/16354.
## Test Plan
I've added some new unit tests for this, plus an integration test for
the user warning.
---------
Signed-off-by: William Woodruff <william@astral.sh>
<!--
Thank you for contributing to uv! To help us out with reviewing, please
consider the following:
- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title?
- Does this pull request include references to any relevant issues?
-->
## Summary
This updates the versions a bit in the new project init.
Scikit-build-core updated to 0.12+, pybind11 updated to 3+ (which allows
a small simplification), and PyO3 updated to 0.28.2+ (which is what I
was running into, it was on an old version).
I also wanted to update the gitignore, as it's missing a bunch of things
for Maturin (like `target/*` and `*.so`!), but I guess that's somewhere
else.
---------
Co-authored-by: konstin <konstin@mailbox.org>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [reflink-copy](https://redirect.github.com/cargo-bins/reflink-copy) |
workspace.dependencies | patch | `0.1.28` → `0.1.29` |
---
### Release Notes
<details>
<summary>cargo-bins/reflink-copy (reflink-copy)</summary>
###
[`v0.1.29`](https://redirect.github.com/cargo-bins/reflink-copy/blob/HEAD/CHANGELOG.md#0129---2026-03-04)
[Compare
Source](https://redirect.github.com/cargo-bins/reflink-copy/compare/v0.1.28...v0.1.29)
##### Fixed
- exclude sparc/sparc64 from linux reflink path
([#​164](https://redirect.github.com/cargo-bins/reflink-copy/pull/164))
##### Other
- Bump actions/checkout from 5 to 6
([#​148](https://redirect.github.com/cargo-bins/reflink-copy/pull/148))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary
`uv export` now carries selected root extras through the export graph
and simplifies `extra` markers on ordinary dependency edges, not just
optional-dependency edges. This fixes cases where --all-extras would
still emit redundant markers for requirements that are unconditional
once the chosen extras are known.
Persists snapshots as artifacts on test failure in CI and adds a script
to apply them locally
```
❯ ./scripts/apply-ci-snapshots.sh
Found pull request #18424 for branch 'zb/ci-snapshots'...
Found latest CI run 23022983761
Downloading pending snapshot artifacts...
Downloaded 3 artifacts
Applying 2 snapshot changes...
accepted:
crates/uv/tests/it/pip_install.rs:13679 (transitive_dependency_config_settings_invalidation-2)
crates/uv/tests/it/python_install.rs:1694 (python_install_default-5)
```
We infer the target run via the `gh` CLI. You may also provide the run
ID directly.
We'll merge snapshot artifacts from multiple platforms, so if there are
platform-specific failures on both Linux and Windows we'll apply both.
renovate[bot]